Overview

overview

10

Static

static

10

JaffaCakes...ac.exe

windows10-2004-x64

10

JaffaCakes...ac.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_bcc2dd8464bab61684599b78716679ac

  • Size

    649KB

  • Sample

    250418-f7fq8awnz4

  • MD5

    bcc2dd8464bab61684599b78716679ac

  • SHA1

    53ed2d9022c3d725768b945cbc5aad6af09b8c76

  • SHA256

    533e64d700f6745e16d371d0543f88cfe3583ba605fdde3f046f29c4f8f0c76b

  • SHA512

    16d56d6482e059d79a536eea7af0e2f1677ba6ff4c32f9ecb65e2dcf60bd8dd9e1e5614354d67fa534ceebbddcb6eb3bde4fa80f899e1ba548638761e7447b63

  • SSDEEP

    12288:s6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhRr:hAmBpVKHu0Mu9Xo20VGLVP5d

Score
10/10
darkcometrundefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Run

C2

goodluck.no-ip.org:135

Mutex

DC_MUTEX-PR2NC79

Attributes
  • InstallPath

    Windupdt\update.exe

  • gencode

    gCDP�Kyeh9HZ

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Wind/update

rc4.plain

Targets

    • Target

      JaffaCakes118_bcc2dd8464bab61684599b78716679ac

    • Size

      649KB

    • MD5

      bcc2dd8464bab61684599b78716679ac

    • SHA1

      53ed2d9022c3d725768b945cbc5aad6af09b8c76

    • SHA256

      533e64d700f6745e16d371d0543f88cfe3583ba605fdde3f046f29c4f8f0c76b

    • SHA512

      16d56d6482e059d79a536eea7af0e2f1677ba6ff4c32f9ecb65e2dcf60bd8dd9e1e5614354d67fa534ceebbddcb6eb3bde4fa80f899e1ba548638761e7447b63

    • SSDEEP

      12288:s6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhRr:hAmBpVKHu0Mu9Xo20VGLVP5d

    Score
    10/10
    darkcometrundefense_evasiondiscoverypersistencerattrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks